do I need a BAA before my first healthcare SaaS pilot?

building a SaaS for small mental health practices — patient intake automation. signing first paid pilot next week with a 4-therapist clinic in austin. they keep asking about a BAA and i'm honestly unsure what i'm signing up for. our app touches PHI clearly (names, intake answers, scheduling).

do i need to have a BAA template ready? do they typically provide one? AWS already has one in place at our infra layer. is that enough?

healthcare ops here, formerly. the AWS BAA covers their layer (infra) but you as the application provider are a "business associate" under HIPAA, and the covered entity (the clinic) needs a BAA WITH YOU directly. AWS BAA does not flow through.

you'll want your own BAA template ready. the clinic will probably push their template at you but read it carefully — clinic templates often have indemnification clauses that are punishing for startups.

+1 to the above. if you let the clinic provide the BAA you're at their mercy. write your own with reasonable liability caps (cap at fees paid in last 12 months is standard) and require them to sign yours OR negotiate theirs.

Quick framework:

You're correct that AWS's BAA covers the infrastructure layer (S3, EC2, RDS) — but you are a separate business associate under 45 CFR 160.103, and the covered entity (the clinic) is required to have a BAA in place with you before disclosing PHI. The AWS BAA flows downstream as part of your subcontractor BAA chain, but does not substitute for your direct BAA with the customer.

Practical pre-launch checklist: (1) BAA template (your own, with reasonable liability caps), (2) Privacy Policy and Notice of Privacy Practices coverage, (3) Risk Analysis under 45 CFR 164.308(a)(1)(ii)(A), (4) breach notification SOP, (5) workforce training records, (6) access logs and audit controls.

Get the BAA right, get the basics in place, iterate.